Manufacturing and testing can be expensive.

Some “forgeries” may be the real deal. Sometimes people are able to dumpster dive or acquire the wafers surplus. A lot of cost is in the manufacturing and testing. If something moderately works its easier to move. This attack is however more limited in that its typically based on targets of opportunity rather than targeting a specific chip. Additionally, it requires access to bonding, packaging, and laser markers.

Its not uncommon for manufacturers to shred old wafers to prevent this sort of forgery.

Probably the easier route. The attacker either finds some surplus chips cheap or maybe something that doesn't work at all and then marks them up to a more expensive chip.

Simple testing can find blatant forgeries. Parts screening may be required to find quality differences and can be difficult to prove to your supplier.

Some clones are clearly marked, others aren't. Someone extremely knowledgeable can usually tell based on fine differences in package marking but most consumers won't have this level of knowledge. Some dies are copied verbatim and so may look identical even close up.

DoD maintains the Defense Microelectronics Activity (DMEA).

• DMEA: http://www.dmea.osd.mil/trustedic.html
• SparkFun Atmega328 slug: http://www.sparkfun.com/products/9831